When Does AI Risk Need an AI Governance Counsel on Staff?

When Does AI Risk Need an AI Governance Counsel on Staff?

A product manager asks on a Thursday whether the support agent can start drafting refund decisions without a human in the loop. Answering needs a read of the vendor contract, the training-data terms, a check on EU exposure, and a written rationale somebody will read back in eighteen months. When that request arrives weekly and lands on a general counsel who also owns commercial contracts, the role is already open.

Three triggers matter more than headcount math. The first is the regulatory calendar. The remainder of the EU AI Act applies from 2 August 2026, which is when the Annex III high-risk obligations and the Article 50 transparency duties stop being a planning exercise ². If you sell into the EU, or your model touches employment, credit or education decisions there, someone has to own the classification argument and put it in writing. The refund agent is exactly the sort of system that has to be argued about rather than assumed, since whether an automated refund denial carries a duty depends on facts nobody in that Thursday thread had to hand. An EU AI Act compliance officer can run the conformity work, but the classification itself is a legal position, and positions need a lawyer's name on them.

The second trigger is contract volume. AI vendor paper is asymmetric in ways standard SaaS redlines never anticipated: indemnity carve-outs for model output, training-data rights buried in an acceptable-use policy, output-ownership clauses that assume the customer read the model card. A generalist can negotiate any one of these well, including the one sitting under the refund agent. Twenty a quarter is a different job.

The third is the rationale itself. When a security reviewer, an auditor or a plaintiff asks why you shipped a system, the useful answer is a dated memo with a named author and the alternatives that were considered. The Thursday thread is not that. McKinsey's State of AI survey puts the share of organizations that hired an AI compliance specialist in the past twelve months at 13 percent ⁴, and the supply side is tight: legal hiring reporting for 2026 describes employers short of candidates who combine legal expertise with AI literacy, while still expecting general counsel to lead AI governance frameworks ³.

Which Arguments Should Your AI Governance Counsel Have Already Lost?

Hand them the Thursday question and ask what they would need before answering it, then ask for three arguments they lost or nearly lost. A vendor indemnity they refused to sign, and the deal delay that followed. A feature they blocked, and what shipped instead. An internal use policy they had to defend to a skeptical engineering lead. Performed expertise recites frameworks. Real expertise remembers what a position cost and who was annoyed by it.

The tells are specific. A strong candidate describes a system's failure mode before its category: not "a high-risk system under Annex III" but "a refund agent that told a customer no and left no reason anyone can retrieve." They distinguish an accurate model from a safe deployment, and they ask what the retrieval pipeline logs before they ask what the policy says. They can name a claim they checked and found wrong. Weak candidates answer every question with the NIST AI Risk Management Framework and never mention your product.

The backgrounds that produce this are wider than the job posts suggest. Privacy counsel who lived through GDPR and CCPA implementations already know how to turn a vague obligation into a shipping checklist. Product counsel at platform companies have negotiated output-ownership language before it had a name. Model-risk lawyers from banks arrived at documented approval trails a decade early, and they treat an undocumented decision as the defect it is.

The unexpected ones are worth an interview slot each. Medical-device and aviation lawyers think in safety cases, which is the closest existing habit to arguing that a system is fit to deploy. Export-controls counsel are used to classification arguments that turn on technical facts they had to learn. Former enforcement staff know what a regulator actually asks for, which is usually the document nobody wrote.

How Does an AI Governance Counsel Get Fluent Without Becoming an Engineer?

By using the systems in their own work, at volume, and being burned by them. The candidates who read as fluent have drafted with a model and then found the clause it invented. They have asked an assistant for the authority behind a confident sentence and watched it produce a case that does not exist. That practice, repeated, is what separates fluency from vocabulary.

It shows up in how they hedge. Someone who has actually verified model output says "often" where a brochure says "reliably," and they can tell you which of their own drafting tasks they stopped delegating. They know that a citation from a model is a lead, not a source. They tend to keep a habit of checking one claim per document against something outside the conversation, and they will describe that habit unprompted.

Test it rather than discussing it. Give a real candidate the paper behind the Thursday question: the refund agent's vendor data processing addendum, the model card for the model underneath it, forty minutes, and an assistant they are told to use. Ask for a one-page position on whether the contract supports running that agent with no human in the loop. What you are reading is the same instinct an AI evals engineer brings to a benchmark, applied to paper: does this person check the thing that would sink them, or accept the first fluent answer.

Watch for the lawyer who treats the model as a black box and the policy as the whole job. Not knowing how a transformer works is survivable and teachable in a quarter. Declining to look inside the system is neither, because the policy then has nothing to be checked against. The counsel you want asks what the eval coverage is, notices when a vendor's accuracy claim has no denominator, and knows the difference between a guardrail in the prompt and a guardrail in the pipeline.

Source Your AI Governance Counsel From the Privacy Bar, Not the Job Board

Post the role, then largely ignore the inbound. The people worth interviewing are already doing a version of this work under an older title: privacy counsel at a company that shipped a model, product counsel at a platform, model-risk lawyers at a bank, regulators who ran an AI inquiry. Find them where they argue in public, which is professional bodies, bar committees and the comment record.

The IAPP is the densest room, and its AI governance credential is a reasonable filter for people who chose to study this before it was funded. Bar association technology and AI committees at the state and ABA level produce speakers and drafters whose names are on the record. Data protection officer networks in the EU are full of people who have already run one classification exercise under pressure. Public comment letters on AI rulemakings are the best sourcing list nobody uses: those are lawyers who put a reasoned position and their own name in a permanent file.

Adjacent internal moves are usually faster than the market. The privacy lead who has been quietly reviewing AI vendors for a year is a candidate with a running start and no ramp on your contracts. So is an AI product counsel at a company one stage larger than yours who wants the whole surface rather than one product line.

Closing them is about authority, not cash. This candidate has watched a governance role become a rubber stamp, and the first question they will ask is whether they can say no and have it hold, which in practice means whether they can stop the refund agent shipping and who is allowed to overrule them. Give them a written charter, a reporting line into legal, a standing seat in design review before the build, and a budget for outside counsel and a technical advisor. What kills the offer: the word "advisory," a dotted line into engineering, and a company that already shipped the thing and wants a lawyer to ratify it.

Pay an AI Governance Counsel Against Governance Bands, and Settle the On-Site Question Early

No salary series tracks this exact title yet, so anchor on AI governance bands rather than litigation bands. One vendor's 2026 AI governance salary report puts mid-career and manager-level US AI governance roles at $140,000 to $218,000 base as of mid-2026, and cites LinkedIn's skills reporting for AI governance demand up 150 percent year over year ¹. That is a single report, not a series, and a bar-licensed candidate sits at its top or above it.

Treat that as a floor for a lawyer, not a midpoint. The band covers program managers and policy staff as well as counsel, and the same report notes wide variation between aggregators for senior AI roles, which is the ordinary signature of a title that is still forming ¹. The proxy that actually holds is your in-house product counsel band at your stage, plus equity, because that is the band already priced for a lawyer who sits in design review and can hold a launch. The differentiator is rarely base. Candidates leave for scope.

On location, the work splits cleanly. Drafting, contract review and classification memos travel anywhere. The parts that decide whether the role works are live: design review, incident calls, a negotiation where the other side's counsel is testing how much you understand. Fully remote is workable with a real travel budget and a hard rule that design review is attended, not read about. The Thursday question gets decided in that room or it gets decided without a lawyer. Hybrid at two or three days is the common shape. Regulated environments with on-premise data or classified deployments will set their own answer, and it is usually on-site.

One caution on every date and threshold here. The EU AI Act timeline is public and dated ², but exposure depends on your contracts, your deployment geography and your role in the supply chain. Confirm yours with counsel who has read the paper, and give the person you hire the mandate to disagree with this article.

Read the evidence >